1. Field of the Invention
The field of the invention relates to the operational security, safety and reliability of Man/Machine Interface systems displaying information in the form of graphics or symbology.
The field of application is more particularly that of cockpit display systems on board aircraft. This type of system is designed to display critical information for the piloting or the navigation of the aircraft. The erroneous display of certain parameters may lead to catastrophic situations for the operational safety of the aircraft. Since the basic integrity or the reliability of the display system is not sufficient to guarantee the demands on safety and security, dedicated monitoring mechanisms designed to detect possible display errors need to be implemented.
Clearly, in view of the safety and security constraints specific to this field, the main target field for this type of application is aeronautics. The invention may, however, be applied to any Man/Machine Interface system requiring a high degree of security or reliability and comprising graphical displays, such as the systems employed for rail transport or the centralized control and command systems for civil or military applications.
2. Description of the Prior Art
There exist several solutions for ensuring the operational safety and reliability of a display system.
Historically, the operational reliability of an onboard display system is principally ensured by a feedback mechanism.
The principle is illustrated in FIG. 1. A display system 1 is disposed between one or more sensors 2 and a display screen 3. It essentially comprises 3 sub-systems which are:                A device 4 for acquiring parameters coming from the sensor or sensors 2 which will be denoted measured-parameters;        A device 5 for processing the said parameters;        A graphics generation device 6 providing the interface with the display screen 3.        
The feedback mechanism also comprises 3 sub-systems which are:                A second device 17 for acquiring parameters coming from the sensor or sensors 2, identical to the previous device 4 and operating in parallel with it;        A computing device 8 which, starting from the data produced by the graphics generation device, recalculates in reverse the original parameters coming from the sensors 2 which will be denoted calculated-parameters;        A monitoring device 9 which provides the comparison between the measured-parameters and the calculated-parameters.        
This monitoring technique has a certain number of drawbacks and limitations:                Initially designed to ensure the integrity of cathode-ray tube display systems, since going over to liquid-crystal, or LCD, screens, this technique no longer covers the entirety of the display system, requiring the implementation of additional security mechanisms.        The asynchronism existing between the display system and its monitoring means that a strict comparison is not possible, requiring the introduction of either corrections δ or monitoring inhibition mechanisms, if the dynamic range of the input parameter is too large.        The inverse algorithm possesses its own noise which does not allow a strict comparison. The performance of the detection therefore rests on the specification of the corrections δ.        This technique requires the ability to sample graphical information of the vector or apex type in order to supply the monitoring system. This information is not available with certain technologies. Indeed, it is not possible to access this type of information with components of the GPU (Graphics Processing Unit) type that are widely employed for generating graphical functions. It is not therefore adapted to the new display architectures. As a result, this technique is neither generic nor portable with regard to the new generation of graphics generation technologies.        The computing load required for the inverse calculation is significant.        The very principle of the inverse algorithm makes the solution totally dedicated to the displayed symbology and is not generic with regard to the various possible applications.        
Another solution consists in implementing two dissimilar Graphics Generation channels denoted channel 1 and channel 2:                Channel 1: nominal channel identical to the previous display system and generating the whole image to be displayed including the critical and non-critical symbols.        Channel 2: monitoring channel generating an image limited to the critical symbols. This channel is implemented in a dissimilar manner to the nominal channel 1.        
The objective of the monitoring is to verify that the two channels really have generated the same image for the critical symbols. Two solutions are implemented:                Implementation of a function for comparing the two images generated, or        Superimposition on the screen of the two images. In the case of a difference, this will be detected visually by the human operator using this screen.        
This solution has the following drawbacks:                Partial verification of the display system, only the Graphics Generation part of the functional system being operationally secured.        Increase in equipment costs by implementation of hardware and software resources necessary for the second dissimilar channel.        Dependency of the solution on the chosen application, this solution depending on the symbology displayed.        Complexity and difficulty in the implementation of the function for comparing two images. Indeed, since the graphics algorithms of the two channels are dissimilar, they will not necessarily generate images that are comparable to within a pixel. Moreover, the full image of channel 1 may have different background colors from those of the monitoring channel 2, which makes a simple pixel by pixel comparison very difficult.        Difficulty in the clarity of the visual effect in the case of a superimposition of images. Indeed, it must be guaranteed that the visual effect is sufficiently obvious so that the operator can easily detect the error under any kind of observational conditions.        